Content Planner Pro WP Registry grade B. Medium-severity findings · 1 findingWP RegistryMedium-severity findings · 1 findingOpen the reportB

Medium-severity findings.

Audited release

2.1.0

Findings

1

Worst severity

medium

Content hash

1441eacd5ba44d046b7fee5f… Copy

Findings

• medium Premium feature loader eval()s remote decrypted PHP

  eval_by_design

  When licensed, cpp_download_premium() POSTs to CPP_API_URL /premium, stores ciphertext in option cpp_premium_files, then cpp_load_premium_code() AES-decrypts and eval()s it. Encryption key is derived from the license key. This is intentional remote code execution gated on the vendor API integrity; compromise of the API, MITM, or option write yields RCE.

  inc/license.php:340-361

  Recommendation

  Ship premium PHP as signed files in the plugin package or verify a cryptographic signature over the payload before include; avoid eval of network-fetched code.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.